Wangwei Touch

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill appears low-impact, but its documentation and scripts conflict about what it actually does, so users should review it before installing.

Review this skill before installing because it does not appear to do what its description suggests. It looks technically low-risk because it only prints text, but the mixed echo/backup wording and hardcoded output make it unreliable as published.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The file describes a simple echo capability, but the observed behavior reportedly differs in material ways, including not using user input and repeating output. That mismatch undermines user expectations and can be used to mask unexpected operations or nuisance behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The file describes a simple echo capability, but the observed behavior reportedly differs in material ways, including not using user input and repeating output. That mismatch undermines user expectations and can be used to mask unexpected operations or nuisance behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The file describes a simple echo capability, but the observed behavior reportedly differs in material ways, including not using user input and repeating output. That mismatch undermines user expectations and can be used to mask unexpected operations or nuisance behavior.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description at L03 ('echo ni shuo de hua') and the standalone activation-like text at L08 ('auto echo ni shuo de hua') do not define a specific trigger scope or constraints. This phrase is broad natural language and the file provides no negative examples or narrow context, which could cause unintended invocation collisions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Presenting the skill as both an echo tool and a 'Cron Backup' skill creates ambiguity about its true purpose. In security review, that inconsistency increases risk because benign branding can be used to disguise unrelated behavior or to lower reviewer scrutiny.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation labels the commands as backup operations even though the skill is described elsewhere as a simple echo utility. Conflicting operational descriptions are risky because they obscure what the referenced scripts are for and can cause users to run commands under false assumptions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The comments name the file as "echo.sh" and document usage as "./echo.sh abc", implying the script echoes the supplied argument. The implementation does not reference any argument and instead prints the literal string "abc" repeatedly.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The manifest description "echo ni shuo de hua" implies repeating user-provided text. Instead, the script never reads arguments and emits the constant string "abc" many times, which does not match the claimed behavior.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comments identify the file as 'echo.sh' and show usage './echo.sh abc', which suggests the script should output the supplied argument. In reality, the code does not reference positional parameters and only prints the literal string 'abc', contradicting the documented intent.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest description 'echo ni shuo de hua' implies repeating what the user says. However, the implementation emits the constant string 'abc' repeatedly and never reads or uses any provided argument, so the actual behavior does not match the claimed purpose.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest description "echo ni shuo de hua" implies the skill should repeat back user-provided text. However, the implementation ignores any arguments and emits the hardcoded string "abc" many times, which does not match the described behavior.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The description and repeated wording use Chinese-language phrasing ('ni shuo de hua') without any indication that language selection is optional or region-specific. That can amount to a locale/language policy issue when a skill implicitly forces one language absent user opt-in or documented justification.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The comments label the file as "echo.sh" and document usage as "./echo.sh abc", implying the argument is what will be echoed. In reality, the script ignores all inputs and prints "abc" unconditionally, so the documentation contradicts the implementation intent.

Static analysis

No suspicious patterns detected.